Privacy Policy

1. Information We Collect

We collect information you provide directly and information generated automatically when you use the Service.

2. How We Use Your Information

• Provide the Service — process your claims, generate AI letters, deliver call coaching, and produce settlement analyses.
• AI processing — analyze your claim data with artificial intelligence to generate personalized guidance, documents, and recommendations.
• Service delivery — process payments, send transactional emails, and deliver requested outputs.
• Analytics and improvement — understand how users interact with the Service to improve features, fix bugs, and enhance the user experience using de-identified, aggregated data.
• Communicate with you — send transactional emails (receipts, status updates) and, with your consent, product updates and tips.
• Ensure security — detect and prevent fraud, abuse, and unauthorized access.
• Meet legal obligations — comply with applicable laws, regulations, and legal processes.

3. AI Data Handling

InsurifyAI uses artificial intelligence to analyze your claim data and generate documents, coaching suggestions, and strategy recommendations. Here is what you should know:

• Your claim data is processed by our AI systems solely to provide the Service to you.
• We use the Anthropic Claude API for language processing. Data sent to Anthropic via the API is not used to train their models. This is governed by our data processing agreement with Anthropic.
• AI outputs (demand letters, estimates, coaching tips) are generated on a per-claim basis and are not shared with other users.
• We may use de-identified, aggregated patterns to improve our AI models. Individual claim data is never used in a way that could identify you.
• You can request deletion of your data and all associated AI outputs at any time (see "Your Rights" below).

4. Voice Recording Disclosure

Our call coaching feature involves the recording and transcription of voice audio:

• Processing provider: Voice recordings are processed by Deepgram for speech-to-text transcription. Deepgram processes audio under our data processing agreement and does not retain your recordings after processing.
• Consent: You will be prompted to provide explicit consent before each recording session begins. You may decline recording and still use other features.
• Two-party consent states: If you reside in a two-party consent state (e.g., California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, Washington), you must obtain consent from all parties on the call before using the recording feature during live conversations.
• Storage: Transcribed text is stored with your claim data. Raw audio files are deleted within 30 days of transcription.
• Deletion: You may request deletion of all voice recordings and transcripts through your account settings.

5. Insurance Credential Handling

If you choose to link your insurance account for automated data retrieval:

• Credentials are encrypted using AES-256-GCM before storage.
• Encryption keys are managed through AWS Key Management Service (KMS) with automatic rotation.
• Access to stored credentials is restricted to the automated retrieval service only. Human team members cannot view or access your insurance login details.
• You may revoke access and delete stored credentials at any time through Settings > Privacy.

6. Information Sharing

We share data only in these limited circumstances:

• Service providers — trusted vendors who help us operate the Service, including:
  • Stripe (payment processing)
  • AWS (cloud hosting and storage)
  • Anthropic (AI language processing)
  • Deepgram (speech recognition)
  • Clerk (authentication)
  • PostHog (analytics, with consent)
  • Sentry (error monitoring)
  All service providers are contractually obligated to protect your data and use it only for the purposes we specify.
• Legal requirements — when required by law, subpoena, court order, or government request.
• Safety — to protect the rights, safety, or property of InsurifyAI, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, your information may be transferred. You will be notified of any such change in ownership or use of your data.

7. Data Retention

We retain your data for as long as necessary to provide the Service and comply with our legal obligations:

• Claim data — retained for 7 years from claim closure, consistent with insurance industry record-keeping requirements.
• Voice recordings (raw audio) — deleted within 30 days of transcription.
• Voice transcripts — retained with claim data for up to 7 years.
• Financial records — retained for 10 years as required by tax and financial regulations.
• Personal account data — retained for 3 years after account closure, then securely deleted.
• Audit logs — retained for 10 years for compliance and security purposes.
• After account deletion — minimal records required for legal compliance are retained for up to 90 days, then permanently deleted.

You may request earlier deletion of your data subject to applicable legal retention requirements (see "Your Rights" below).

8. Your Rights

We respect your data rights. Depending on your location, you may have the following rights:

To exercise your rights, you may submit a request through your account settings or by emailing privacy@insurifyai.app. We will respond to verifiable requests within 45 calendar days.

9. Security Measures

We implement industry-standard security measures to protect your data:

• Encryption at rest — all stored data is encrypted using AES-256-GCM.
• Encryption in transit — all network communication uses TLS 1.3.
• Key rotation — encryption keys are rotated every 90 days.
• Access controls — role-based access controls limit employee access to user data.
• Audit logging — all access to user data is logged and monitored.
• Infrastructure — hosted on AWS with SOC 2 Type II certified infrastructure.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. If you believe your account has been compromised, contact us immediately.

10. Cookie Policy

We use the following types of cookies and similar technologies:

You can manage your cookie preferences at any time through the cookie consent banner or your browser settings.

11. Children's Privacy (COPPA)

InsurifyAI is not intended for use by individuals under the age of 18. In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected personal information from a child under 13, we will take immediate steps to delete that information. If you believe a child has provided us with personal information, please contact us at privacy@insurifyai.app.

12. State-Specific Disclosures

In addition to the CCPA rights described above, residents of certain states have additional privacy rights:

13. Changes to This Policy

We may update this Privacy Policy from time to time by posting the revised version on this page with a new "Last updated" date. If we make material changes, we will notify you by email or through an in-app notification at least 30 days before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.